Event ID 13365 An exception occurred in 'RemoveCollection'

[Saqib_A__Shamsi]

Hi,

I've been getting an error logged in the event viewer every 5 minutes since last night on the EV server. The event details are:

Log Name:      Symantec Enterprise Vault
Source:        Enterprise Vault
Date:          6/22/2012 3:03:29 AM
Event ID:      13365
Task Category: Storage Management
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      ALGVLT.Alghanim.com
Description:
An exception occurred in 'RemoveCollection'

There isn't any other event along with this. Tried searching in the KB and forums and found nothing. Did a google, and got only 11 entries with nothing related to EV. So am finally posting here. Has anyone else faced this problem and resolved it? I did a DTrace of the Storage Management and found nothing but just the above event. The trace is as below:

===========================================================================================================
512 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::StorageClientInterface::GetClient} (Entry)
513 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::StorageClientInterface::GetClient} (Exit) Status: [Success]
514 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::ClientStatusImpl::IsRunning} (Entry)
515 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::Started} (Entry)
516 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::Started} (Exit) Status: [Success]
517 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::IsRunning} (Entry)
518 18:00:03.447  [13672] (StorageManagement) <12416> EV:L The event is NOT signaled
519 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::IsRunning} (Exit) Status: [Success]
520 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {EVStorage::ClientStatusImpl::IsRunning} (Exit) Status: [Success]
521 18:00:03.447  [13672] (StorageManagement) <12416> EV:M CReportingConsolidationHelper::ThreadExecution - Storage Server is still running
522 18:00:03.447  [13672] (StorageManagement) <12416> EV:M CReportingConsolidationHelper::ThreadExecution - consolidating archiving statistics
524 18:00:03.447  [13672] (StorageManagement) <12416> EV:L CBaseDirectoryServiceWrapper::CreateDirectoryService() - Entry [m_nNumTries = 40]
525 18:00:03.447  [13672] (StorageManagement) <12416> EV:L CBaseDirectoryServiceWrapper::CreateDirectoryService() - Successfully communicated with an EV Directory Service on the local machine
526 18:00:03.447  [13672] (StorageManagement) <12416> EV:L {CReportingConsolidationHelper::AggregateReportingData} (Entry)
528 18:00:03.447  [13672] (StorageManagement) <12416> EV:L CBaseDirectoryServiceWrapper::CreateDirectoryService() - Entry [m_nNumTries = 40]
529 18:00:03.447  [13672] (StorageManagement) <12416> EV:L CBaseDirectoryServiceWrapper::CreateDirectoryService() - Successfully communicated with an EV Directory Service on the local machine
530 18:00:03.462  [13672] (StorageManagement) <12416> EV:L CDirectoryVaultObject::GetAttributeListFromType Unknown type - view_VSEntry_VSGroup_OpenPartition
531 18:00:03.462  [13672] (StorageManagement) <12416> EV:M CPartitionProperties::CPartitionProperties - vsId = [1], partitionId = [2]
533 18:00:03.462  [13672] (StorageManagement) <12416> EV:L CBaseDirectoryServiceWrapper::CreateDirectoryService() - Entry [m_nNumTries = 40]
534 18:00:03.462  [13672] (StorageManagement) <12416> EV:L CBaseDirectoryServiceWrapper::CreateDirectoryService() - Successfully communicated with an EV Directory Service on the local machine
535 18:00:03.462  [13672] (StorageManagement) <12416> EV:L {CVaultStorePartitionCache::LoadEntry:#493} Successfully loaded partition info for Vault Store [1229FA4231DA4CA44B8EAEE3CE1491E2F1210000ALGVLT.Alghanim.com] from Directory
536 18:00:03.462  [13672] (StorageManagement) <12416> EV:L {CVaultStorePartitionCache::ReadEntry:#210} Successfully read partition info for Vault Store [1229FA4231DA4CA44B8EAEE3CE1491E2F1210000ALGVLT.Alghanim.com] (used [0]ms timeout)
537 18:00:03.478  [13672] (StorageManagement) <7468> EV:M SingletonRegistry: RS '0X3F6D728TransactionContext'
538 18:00:03.478  [13672] (StorageManagement) <7468> EV:M SingletonRegistry: RS '0X3F6D7281'
539 18:00:03.478  [13672] (StorageManagement) <7468> EV:M SingletonRegistry: RS '0X3F6D728'
540 18:00:03.478  [13672] (StorageManagement) <7468> EV:L CADOContext::CreateConnection entry
541 18:00:03.494  [13672] (StorageManagement) <7468> EV:L CADOContext::CreateConnection exit. source:EVVSVS1_1 hr=Success  (0)
542 18:00:03.494  [13672] (StorageManagement) <12416> EV:L CVaultStoreDB::AggregateReportingData Information: Going to execute reporting aggregation SP.
543 18:00:03.494  [13672] (StorageManagement) <12416> EV:L CVaultStoreDb::GetConnectionString() connection string: Provider=SQLOLEDB;Server=sqlpr2;Database=EVVSVS1_1;Trusted_Connection=yes
544 18:00:03.494  [13672] (StorageManagement) <12416> EV:L CADOContext::CreateConnection entry
545 18:00:03.494  [13672] (StorageManagement) <12416> EV:L CADOContext::CreateConnection exit. source:Provider=SQLOLEDB;Server=sqlpr2;Database=EVVSVS1_1;Trusted_Connection=yes hr=Success  (0)
546 18:00:03.494  [13672] (StorageManagement) <12416> EV:L CADODataAccess::CreateCommand entry
547 18:00:03.494  [13672] (StorageManagement) <12416> EV:L CADODataAccess::CreateCommand exit. hr=Success  (0)
548 18:00:03.494  [13672] (StorageManagement) <12416> EV:L CVaultStoreDB::AggregateReportingData Information: Executed reporting aggregation SP.
549 18:00:03.494  [13672] (StorageManagement) <7468> EV~E Event ID: 13365 An exception occurred in 'RemoveCollection' |
550 18:00:03.494  [13672] (StorageManagement) <7468> EV:M SingletonRegistry: US '0X3F6D728TransactionContext'
551 18:00:03.494  [13672] (StorageManagement) <12416> EV:L {CReportingConsolidationHelper::AggregateReportingData} (Exit) Status: [Success]
554 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::StorageClientInterface::GetClient} (Entry)
555 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::StorageClientInterface::GetClient} (Exit) Status: [Success]
556 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::ClientStatusImpl::IsRunning} (Entry)
557 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::Started} (Entry)
558 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::Started} (Exit) Status: [Success]
559 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::IsRunning} (Entry)
560 18:00:13.509  [13672] (StorageManagement) <12416> EV:L The event is NOT signaled
561 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::ProcessMonitor::IsRunning} (Exit) Status: [Success]
562 18:00:13.509  [13672] (StorageManagement) <12416> EV:L {EVStorage::ClientStatusImpl::IsRunning} (Exit) Status: [Success]
563 18:00:13.509  [13672] (StorageManagement) <12416> EV:M CReportingConsolidationHelper::ThreadExecution - Storage Server is still running
565 18:00:20.451  [13672] (StorageManagement) <4200> EV:L {EVStorage::ProcessMonitor::MonitorProcess} (Entry)
566 18:00:20.451  [13672] (StorageManagement) <4200> EV:L {EVStorage::ProcessMonitor::IsRunning} (Entry)
567 18:00:20.451  [13672] (StorageManagement) <4200> EV:L The event is NOT signaled
568 18:00:20.451  [13672] (StorageManagement) <4200> EV:L {EVStorage::ProcessMonitor::IsRunning} (Exit) Status: [Success]
569 18:00:20.451  [13672] (StorageManagement) <4200> EV:L {EVStorage::ProcessMonitor::MonitorProcess} (Exit) Status: [Success]
===========================================================================================================

So really can't make much of the dtrace as well. Any ideas if I should run a dtrace on any other service along with the storage management?

A short brief on my environment... EV10.0 on Windows Server 2008 R2 SP1 with an off-box SQL 2008 R2 Database, running only Mailbox Archiving.

Hoping to hear from someone soon.

[TonySterling · Accepted solution]

I don't suppose there is any other text in that event?  Do you have reporting installed?  Any recent changes?

There was a similar issue in the past, but the event id is different for it.

Event Id's 4167 and 13343 are logged when auditing Retrievals of an archived message.

Article: TECH65111

|

Created: 2008-01-13

|

Updated: 2011-06-17

|

Article URL http://www.symantec.com/docs/TECH65111

[Saqib_A__Shamsi]

Yes we have the SQL reporting services running on the EV server, but the report database on the off-box SQL server. As far as the event goes, no, that was the only text that makes it quite difficult to debug. There have been a few changes in the last two days, in terms that I have done a few registry edits based on various articles. The event log was filled with tons of errors and warning which I had started to clear with values such as RecipientMax, AttachmentMax, DSServer, UseLocalDirectory, etc. All those events have gone now for the last 24 hours and archiving has been tremendously faster than ever before. A pretty clean log now, except for this event that started this morning. Everything though seems to be working fine.

As for the article you've posted, I did see that. We do have auditing enabled, but when I went to the properties > advanced page, the first check mark at the top "Log database information" is not checked. So I assumed, the values below would have no effect. Or should I still increase the value as per the article?

Just a note, the last of the registry changes made was at 8pm last night, and archiving was on after that. The event 13365 started off at 3am the following morning and has been on ever since every 5 minutes, now being 10pm.

[TonySterling]

So what it looks like to me is that the Stored Procedure used to collect information for Reporting is having a bit of an issue.

Does your Archived Item Rate reports work as expected?

You might very well need to open a case with support.

[Saqib_A__Shamsi]

Yep, I had tried the Archival Rate report and it's working perfectly fine. In fact just logged in and archiving started as scheduled a few minutes ago, and the report does show up, while the 13365 error is still being logged.

Well I guess then I'll open a case with support, and once solved, will update the solution over here :)

[JesusWept3]

For what its worth , RemoveCollection() is a generic programming call made by either C++, C# etc

[Saqib_A__Shamsi]

Hi All,

I managed to resolve the problem with the same article http://www.symantec.com/docs/TECH65111

I went to the help for the Auditing properties, and found that the option "log database information" is just to enable/disable the logging of events that show the connections used or available. So looking at that, what I understand is that the options below is where you describe the number of connections and has no relation with the check box. So I went ahead and increased the connections from 4 to 8 and restarted the service. Been over 24 hours and working fine... no errors recording.

Regards,
Saqib